5

I am trying to use Postfix header_checks to [redirect/prepend/reject/anything] incoming email with a spamassassin score of >= 5.

I can run postmap -q - regexp:/etc/postfix/header_checks on email messages and it catches what I would expect (messages with spam level > 5); however, nothing is happening to incoming email.

This is /etc/postfix/header_checks

/X-Spam-Level:\s*\*{5,}/ REDIRECT [email protected]

Here is the output of postconf -n:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
header_checks = regexp:/etc/postfix/header_checks
inet_interfaces = all
mailbox_size_limit = 0
milter_default_action = accept
milter_protocol = 2
mydestination = localhost
myhostname = emaproduction.mydomain.com
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = /etc/mailname
non_smtpd_milters = inet:localhost:8891
readme_directory = no
recipient_delimiter = +
relayhost =
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_milters = inet:localhost:8891
smtpd_relay_restrictions = permit_sasl_authenticated permit_mynetworks               reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = private/auth
smtpd_sasl_type = dovecot
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/ssl/certs/dovecot.pem
smtpd_tls_key_file = /etc/ssl/private/dovecot.pem
smtpd_use_tls = yes
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_transport = lmtp:unix:private/dovecot-lmtp

Within the logs I see the message going through postfix and then a line similar to this:

relay=spamassassin, delay=0.76, delays=0.25/0.01/0/0.5, dsn=2.0.0, status=sent (delivered via spamassassin service)

Here is the full output of the logs surrounding one of the messages in question:

/var/log/mail.log 
May  6 09:27:40 emaproduction postfix/smtpd[10044]: connect from mail-wi0-f182.google.com[209.85.212.182] 
May  6 09:27:41 emaproduction postfix/smtpd[10044]: 5796F2E2AF: client=mail-wi0-f182.google.com[209.85.212.182] 
May  6 09:27:41 emaproduction postfix/cleanup[10085]: 5796F2E2AF: message-id=<CAKiO3cJu_5vF7-J_---edited-out----oi3iuSPQ_NSobSkj0Q@mail.gmail.com> 
May  6 09:27:41 emaproduction opendkim[19408]: 5796F2E2AF: mail-wi0-f182.google.com [209.85.212.182] not internal 
May  6 09:27:41 emaproduction opendkim[19408]: 5796F2E2AF: not authenticated 
May  6 09:27:41 emaproduction opendkim[19408]: 5796F2E2AF: no signature data 
May  6 09:27:41 emaproduction postfix/qmgr[9847]: 5796F2E2AF: from=<[email protected]>, size=2016, nrcpt=1 (queue active) 
May  6 09:27:41 emaproduction postfix/smtpd[10044]: disconnect from mail-wi0-f182.google.com[209.85.212.182] 
May  6 09:27:43 emaproduction postfix/pickup[9846]: 0ABDF2E895: uid=5001 from=<[email protected]> 
May  6 09:27:43 emaproduction postfix/pipe[10023]: 5796F2E2AF: to=<[email protected]>, relay=spamassassin, delay=1.8, delays=0.24/0/0/1.5, dsn=2.0.0, status=sent (delivered via spamassassin service) 
May  6 09:27:43 emaproduction postfix/qmgr[9847]: 5796F2E2AF: removed 
May  6 09:27:43 emaproduction postfix/cleanup[10047]: 0ABDF2E895: message-id=<CAKiO3cJu_5vF7-J_---edited-out-----oi3iuSPQ_NSobSkj0Q@mail.gmail.com> 
May  6 09:27:43 emaproduction opendkim[19408]: 0ABDF2E895: no signing table match for '[email protected]' 
May  6 09:27:43 emaproduction opendkim[19408]: 0ABDF2E895: no signature data 
May  6 09:27:43 emaproduction postfix/qmgr[9847]: 0ABDF2E895: from=<[email protected]>, size=2429, nrcpt=1 (queue active) 
May  6 09:27:43 emaproduction postfix/lmtp[10028]: 0ABDF2E895: to=<[email protected]>, relay=emaproduction.mydomain.com[private/dovecot-lmtp], delay=0.03, delays=0.01/0/0/0.01, dsn=2.0.0, status=sent (250 2.0.0 <[email protected]> yEEyA0/jaFO2JwAAL7A4mg Saved) 
May  6 09:27:43 emaproduction postfix/qmgr[9847]: 0ABDF2E895: removed

At first I thought this indicated spamassassin was between Postfix and Dovecot; however, it appears that Postfix receives the message back from Spamassassin and then sends it on. We ended up testing this with a non-spamassassin related header (Return-Path) to see if that worked, but still nothing happens. This leads me to believe I'm missing a configuration option that enables header checks, beyond simply including header_checks = regexp:/etc/postfix/header_checks in main.cf.

Here is the output of postconf -M (the master.cf file)

smtp       inet  n       -       -       -       -       smtpd -o content_filter=spamassassin 
submission inet  n       -       -       -       -       smtpd -o smtpd_sasl_auth_enable=yes -o smtpd_relay_restrictions=permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
smtps      inet  n       -       n       -       -       smtpd -o smtpd_sasl_auth_enable=yes -o smtpd_relay_restrictions=permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination 
pickup     unix  n       -       -       60      1       pickup 
pickup     fifo  n       -       -       60      1       pickup -o content_filter= -o receive_override_options=no_header_body_checks 
cleanup    unix  n       -       -       -       0       cleanup 
qmgr       unix  n       -       n       300     1       qmgr 
tlsmgr     unix  -       -       -       1000?   1       tlsmgr 
rewrite    unix  -       -       -       -       -       trivial-rewrite 
bounce     unix  -       -       -       -       0       bounce 
defer      unix  -       -       -       -       0       bounce 
trace      unix  -       -       -       -       0       bounce 
verify     unix  -       -       -       -       1       verify 
flush      unix  n       -       -       1000?   0       flush 
proxymap   unix  -       -       n       -       -       proxymap 
proxywrite unix  -       -       n       -       1       proxymap 
smtp       unix  -       -       -       -       -       smtp 
relay      unix  -       -       -       -       -       smtp 
showq      unix  n       -       -       -       -       showq 
error      unix  -       -       -       -       -       error 
retry      unix  -       -       -       -       -       error 
discard    unix  -       -       -       -       -       discard 
local      unix  -       n       n       -       -       local 
virtual    unix  -       n       n       -       -       virtual 
lmtp       unix  -       -       -       -       -       lmtp 
anvil      unix  -       -       -       -       1       anvil 
scache     unix  -       -       -       -       1       scache 
maildrop   unix  -       n       n       -       -       pipe flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient} 
uucp       unix  -       n       n       -       -       pipe flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient) 
ifmail     unix  -       n       n       -       -       pipe flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient) 
bsmtp      unix  -       n       n       -       -       pipe flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient 
scalemail-backend unix - n       n       -       2       pipe flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension} 
mailman    unix  -       n       n       -       -       pipe flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py ${nexthop} ${user} 
smtp-amavis unix -       -       -       -       2       smtp -o smtp_data_done_timeout=1200 -o smtp_send_xforward_command=yes -o disable_dns_lookups=yes -o max_use=20 
127.0.0.1:10025 inet n   -       -       -       -       smtpd -o content_filter= -o local_recipient_maps= -o relay_recipient_maps= -o smtpd_restriction_classes= -o smtpd_delay_reject=no -o smtpd_client_restrictions=permit_mynetworks,reject -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions=permit_mynetworks,reject -o smtpd_data_restrictions=reject_unauth_pipelining -o smtpd_end_of_data_restrictions= -o mynetworks=127.0.0.0/8 -o smtpd_error_sleep_time=0 -o smtpd_soft_error_limit=1001 -o smtpd_hard_error_limit=1000 -o smtpd_client_connection_count_limit=0 -o smtpd_client_connection_rate_limit=0 -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks 
spamassassin unix -      n       n       -       -       pipe user=spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient} 
4
  • Can u post the complete logs? (logs for email hitting your postfix, postfix delivering to SA, SA re injecting to postfix)
    – clement
    May 6, 2014 at 18:37
  • @clement, logs added as well as postconf -M just in case it's helpful May 7, 2014 at 11:15
  • It is because, when you are re-injecting the mail to postfix on port 10025, you specified receive_override_options=no_header_body_checks
    – clement
    May 7, 2014 at 13:09
  • @clement - you rock! I had to remove it from both the pickup fifo and the port 10025 but it is now being forwarded. Please add your comment as an answer so I can accept it and close this. May 7, 2014 at 13:47

1 Answer 1

4

The header_checks didn't happen because receive_override_options=no_header_body_checks is set in main.cf which will disable header and body checks.

Postfix Docs

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .